Port 88 · TCP/UDP

Port 88: Kerberos

Kerberos, the sign-in protocol of Windows domains (Active Directory).

Protocol
TCP/UDP
On Windows
lsass.exe (talking to a domain controller)
Risk if open to the internet
Medium

Seeing it on your PC

A work PC joined to a domain talks to its domain controllers on 88 all the time. A home PC has no reason to.

Should you block it?

Leave it as it is on a work PC. On a home PC, outgoing 88 to the internet is unexpected and worth a look.

Check it on your PC

Run this in PowerShell to see what is using port 88 right now, and which program owns it:

Get-NetTCPConnection -LocalPort 88 -ErrorAction SilentlyContinue | Select-Object LocalAddress,LocalPort,RemoteAddress,RemotePort,State,@{n='Process';e={(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName}}
Get-NetUDPEndpoint -LocalPort 88 -ErrorAction SilentlyContinue | Select-Object LocalAddress,LocalPort,@{n='Process';e={(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName}}

No output means nothing is using the port at the moment. For every connection at once, paste netstat -ano into the netstat explainer.

Block it in Windows Firewall

In PowerShell run as administrator, this stops other computers from connecting to this port on your PC. It does not stop your own programs connecting out.

New-NetFirewallRule -DisplayName "Block inbound TCP 88" -Direction Inbound -Protocol TCP -LocalPort 88 -Action Block
New-NetFirewallRule -DisplayName "Block inbound UDP 88" -Direction Inbound -Protocol UDP -LocalPort 88 -Action Block

Undo it with Remove-NetFirewallRule -DisplayName "Block inbound …", using the same name. If you depend on the service on your local network, this rule stops that too.